BITS Transfer Job Download From Direct IP

Title: BITS Transfer Job Download From Direct IP
Status: test
Description:Detects a BITS transfer job downloading file(s) from a direct IP address.
References:
  -https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  -https://isc.sans.edu/diary/22264
  -https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  -https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
modified:2023-03-27
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1197'

Logsource:

• product: windows
• service: bits-client

Detection:
  selection:
    EventID: '16403'
    RemoteName|contains:
      -'http://1'
      -'http://2'
      -'http://3'
      -'http://4'
      -'http://5'
      -'http://6'
      -'http://7'
      -'http://8'
      -'http://9'
      -'https://1'
      -'https://2'
      -'https://3'
      -'https://4'
      -'https://5'
      -'https://6'
      -'https://7'
      -'https://8'
      -'https://9'

  filter_optional_local_networks:
    RemoteName|contains:
      -'://10.'
      -'://192.168.'
      -'://172.16.'
      -'://172.17.'
      -'://172.18.'
      -'://172.19.'
      -'://172.20.'
      -'://172.21.'
      -'://172.22.'
      -'://172.23.'
      -'://172.24.'
      -'://172.25.'
      -'://172.26.'
      -'://172.27.'
      -'://172.28.'
      -'://172.29.'
      -'://172.30.'
      -'://172.31.'
      -'://127.'
      -'://169.254.'

  filter_optional_seven_zip:
    RemoteName|contains:
      -'https://7-'
      -'http://7-'

  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high